System Rescue & Recovery

Overview: When You Need Rescue Tools

System rescue tools are needed when:

• The system won’t boot (corrupted/missing files, misconfigured services)
• The root password is lost or scrambled
• A filesystem is corrupted and needs repair tools not available from the running OS
• You need to recover data from a machine that cannot start normally

Most Linux distributions let the install media (CD/DVD/USB) and live media serve double-duty as rescue disks.

---

Live and Rescue Media

Live media provide a complete, bootable operating system that runs from memory rather than disk. Key properties:

• You can evaluate a distribution without installing or modifying your disk
• They can boot on a machine with a failed or corrupted hard disk
• They allow you to recover data from a system that cannot start normally

Rescue media (install media in rescue mode) are purpose-built for system recovery. They include:

• Disk utilities: fdisk, mdadm, pvcreate, vgcreate, lvcreate, mkfs - for partition/RAID/LVM repair
• Networking utilities: ip, ssh, scp, traceroute, mtr, host, ftp - for network-based recovery
• General utilities: bash, chroot, ps, kill, vi, dd, tar, cpio, gzip, rpm, mkdir, ls, cp, mv, rm

---

Creating Rescue Media

From a Boot Image

# Write a boot.iso (downloaded from your distro) to a USB drive
dd if=boot.iso of=/dev/sdX

# IMPORTANT: This wipes existing contents on the USB drive
# Replace sdX with your actual USB device (verify with lsblk)

Graphical alternatives: livecd-tools, liveusb-creator, Fedora Media Writer, Etcher, dd_rescue.

Caution

Verify the device with lsblk before running dd. Writing to the wrong device number can destroy data on a different drive.

---

Using Rescue/Recovery Media

Boot Procedure

1. Boot from the rescue USB/DVD
2. Select Rescue Installed System (or similar) from the boot menu
   • Some systems require typing rescue at a boot prompt: boot: Linux rescue
3. Answer setup questions: language, keyboard, where to find the rescue image (CD/DVD, network, NFS, HTTP)
4. When asked about mounting filesystems - choose Yes if you want to access your installed system’s files

Accessing Your Filesystems

If the rescue environment successfully detects your filesystems, they are mounted under /mnt/sysimage:

# Change into your installed system's root
sudo chroot /mnt/sysimage

# Now you're working as if you'd booted normally
# You can: check configs, reinstall packages, reset passwords, fix bootloaders

For network-based rescue, you may also need to mount /mnt/source.

Installing Packages from Rescue

# From inside chroot:
dnf install packagename

# From outside chroot (for RPM-based systems):
sudo rpm -ivh --force --root=/mnt/sysimage /mnt/source/Packages/vsftpd-2*.rpm

---

Emergency Mode

Emergency mode boots into the most minimal environment possible:

• Root filesystem is mounted read-only
• No init scripts are run
• Almost nothing is set up
• You are asked for the root password before getting a shell

The main advantage over single-user mode: if init itself is corrupted, you can still mount filesystems to recover data that would be lost during a reinstall.

Entering Emergency Mode

1. Select an entry from the GRUB boot menu
2. Press e to edit the entry
3. Find the linux line and add emergency at the end of the kernel parameters
4. Press CTRL-X or F10 to boot
5. Enter the root password when prompted

---

Single User Mode

Single user mode is a minimal recovery environment where init starts but most services do not:

What happens	What doesn’t
init starts	Services are NOT started
All possible filesystems mounted	Network is NOT activated
Root shell granted without password	Multiuser environment NOT available

Single user mode boots to runlevel 1 (SysVinit) / rescue target (systemd). Because it tries to mount filesystems, it cannot be used when the root filesystem cannot be mounted or when init itself is corrupted (use emergency mode instead).

Entering Single User Mode

Same as emergency mode, but replace emergency with single in the kernel command line:

linux ... root=/dev/sda1 ro quiet single

---

Common Recovery Tasks

Reset Root Password

# In emergency or single-user mode:
mount -o remount,rw /          # remount root read-write
passwd root                     # set new root password

Or from a rescue environment’s chroot:

chroot /mnt/sysimage
passwd root
exit

Fix a Corrupted Filesystem

# Unmount first (or use rescue media so filesystem isn't mounted)
umount /dev/sda1
fsck -p /dev/sda1              # auto-repair
fsck.ext4 -y /dev/sda1        # force yes to all repairs (ext4)
xfs_repair /dev/sda1          # for XFS

Repair GRUB Bootloader

# From chroot inside rescue:
chroot /mnt/sysimage
grub2-install /dev/sda
grub2-mkconfig -o /boot/grub2/grub.cfg
exit